From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.5 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, SPF_PASS,USER_AGENT_MUTT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E9C86C282CC for ; Mon, 4 Feb 2019 10:03:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B9DF02081B for ; Mon, 4 Feb 2019 10:03:30 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b="S7/q3vcG" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728268AbfBDKD3 (ORCPT ); Mon, 4 Feb 2019 05:03:29 -0500 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:45867 "EHLO out1-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727757AbfBDKD3 (ORCPT ); Mon, 4 Feb 2019 05:03:29 -0500 Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailout.nyi.internal (Postfix) with ESMTP id 536B92147B; Mon, 4 Feb 2019 05:03:28 -0500 (EST) Received: from mailfrontend2 ([10.202.2.163]) by compute6.internal (MEProxy); Mon, 04 Feb 2019 05:03:28 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=6IC0QG /CzrS0jr4vVmIFBeaaesGQy2zZdOeDRsUhYXM=; b=S7/q3vcGILXZ9lFZMvVbS9 S0IUlewhwre9MVnLK4pm3JH/Sy1WMzKEw5Qj8uwoxjbxo43TpkygX5rIbdSMHB0p /Eb/iGfRFfZuzoqOHNNWUUk6jq+DV5S/U5MPIG+4CcKrhWyQ2GqelFbXmUcrnR/9 bXxQO7xGJtM5fe696/8IH999v6nvz5joiWHqzOJ/zXDQdOtycwxmemzpA7yw8Ywh PRy0R3NVgO+NV2lhq3AZfZPa7PaTXFpbqX3zXgqY9qDAEqmSu5PvNeFBMDFgTBKv VJa4Q4R1xitFMmyOt97232SEw4yQjspZDWZAo/gTyZ5l4ZTD5Y8IfS+cW6xrNqgQ == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedtledrkeeggdduudcutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfhuthenuceurghilhhouhhtmecufedt tdenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujfgurhepfffhvffukfhfgg gtuggjfgesthdtredttdervdenucfhrhhomhepifhrvghgucfmjfcuoehgrhgvghhkhhes lhhinhhugidqfhhouhhnuggrthhiohhnrdhorhhgqeenucffohhmrghinhepkhgvrhhnvg hlrdhorhhgnecukfhppeekfedrkeeirdekledruddtjeenucfrrghrrghmpehmrghilhhf rhhomhepghhrvghgsehkrhhorghhrdgtohhmnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: from localhost (5356596b.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) by mail.messagingengine.com (Postfix) with ESMTPA id 5389110318; Mon, 4 Feb 2019 05:03:27 -0500 (EST) Date: Mon, 4 Feb 2019 11:03:26 +0100 From: Greg KH To: Mao Wenan Cc: stable@vger.kernel.org, edumazet@google.com, netdev@vger.kernel.org, davem@davemloft.net, eric.dumazet@gmail.com Subject: Re: [PATCH stable 4.4 v2 00/11] fix FragmentSmack in stable branch (CVE-2018-5391) Message-ID: <20190204100326.GA16835@kroah.com> References: <1548384524-174152-1-git-send-email-maowenan@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1548384524-174152-1-git-send-email-maowenan@huawei.com> User-Agent: Mutt/1.11.3 (2019-02-01) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Fri, Jan 25, 2019 at 10:48:33AM +0800, Mao Wenan wrote: > There is one CVE: CVE-2018-5391 kernel: IP fragments with random offsets allow a > remote denial of service (FragmentSmack), > A fix is a merge commit in the Linux kernel tree: > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c30f1fc041b74ecdb072dd44f858750414b8b19f > > consisting of the following commits: > 7969e5c40dfd04799d4341f1b7cd266b6e47f227 ip: discard IPv4 datagrams with overlapping segments. > 385114dec8a49b5e5945e77ba7de6356106713f4 net: modify skb_rbtree_purge to return the truesize of all purged skbs. > fa0f527358bd900ef92f925878ed6bfbd51305cc ip: use rb trees for IP frag queue. > > All above patches are with rb tree to fix this CVE, which is very similar the CVE-2018-5390, that I have backport > to stable 4.4 branch in last year. > > In these patchset, I will backport some patches to fix CVE-2018-5391 with rb tree. > > v1->v2: in this patch, ipv6: defrag: drop non-last frags smaller than min mtu > fix the incorrect return value of nf_ct_frag6_gather. Thanks for fixing that up, I've queued the patches up now, let's see if they pass the testers :) greg k-h